CVE-2021-43795

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284	Patch Third Party Advisory
https://github.com/line/armeria/pull/3855	Third Party Advisory
https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-12-02 18:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-43795

Mitre link : CVE-2021-43795

CVE.ORG link : CVE-2021-43795

JSON object : View

Products Affected

linecorp

armeria

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2021-43795", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-12-02T18:15:08.267", "references": [{"url": "https://github.com/line/armeria/commit/e2697a575e9df6692b423e02d731f293c1313284", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/line/armeria/pull/3855", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/line/armeria/security/advisories/GHSA-8fp4-rp6c-5gcv", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic. Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path."}, {"lang": "es", "value": "Armeria es un framework de microservicios de c\u00f3digo abierto. En las versiones afectadas, un atacante puede acceder al sistema de archivos local de un servidor de Armeria m\u00e1s all\u00e1 de su directorio restringido mediante el env\u00edo de una petici\u00f3n HTTP cuya ruta contenga \"%2F\" (codificado \"/\"), como \"/files/..%2Fsecrets.txt\", omitiendo la l\u00f3gica de comprobaci\u00f3n de rutas de Armeria. Armeria versi\u00f3n 1.13.4 o superior, contiene una l\u00f3gica de comprobaci\u00f3n de rutas reforzada que maneja \"%2F\" apropiadamente. Esta vulnerabilidad puede solucionarse al insertar un decorador que lleve a cabo una comprobaci\u00f3n adicional en la ruta de petici\u00f3n"}], "lastModified": "2021-12-06T18:24:45.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C4CC5EF-C8FD-41AB-A2C6-DA8D6E3ED2B6", "versionEndExcluding": "1.13.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}